[iwar] [fc:SNMP.Threat.Shows.Why..IT.Can't.Afford.to.Be.Shortsighted]

From: Fred Cohen (fc@all.net)
Date: 2002-02-16 07:52:40

Next message: Fred Cohen: "[iwar] [fc:Clarke:.Terrorist.Organizations.May.Have.Penetrated.Gov.Computers]"
Previous message: Fred Cohen: "[iwar] [fc:Return.Of.The.'Military-Industrial.Complex'?]"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Message-Id: <200202161552.g1GFqeH21027@red.all.net>
To: iwar@onelist.com (Information Warfare Mailing List)
Organization: I'm not allowed to say
From: Fred Cohen <fc@all.net>
Mailing-List: list iwar@yahoogroups.com; contact iwar-owner@yahoogroups.com
Precedence: bulk
Date: Sat, 16 Feb 2002 07:52:40 -0800 (PST)
Subject: [iwar] [fc:SNMP.Threat.Shows.Why..IT.Can't.Afford.to.Be.Shortsighted]
Reply-To: iwar@yahoogroups.com
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 8bit

SNMP Threat Shows Why  IT Can't Afford to Be Shortsighted

By Cameron Sturdevant, EWeek, 2/14/02
www.eweek.com

A network security audit should be near the top of IT managers' list of
things to do since Tuesday's disclosure of the existence of a test tool
that, when used maliciously, can overcome SNMPv1 (Simple Network
Management Protocol, version 1) in a wide variety of caching devices,
routers, switches, printers and a myriad of other infrastructure
devices.

Instead of making the security audit the first step in a remediation
plan, eWEEK Labs recommends that IT managers take this occasion to put
together a plan that enables ongoing management of the wide range of
devices that are threatened.

A security audit is a good opportunity to manage devices with both
short-term and long-term perspectives to reduce IT costs and improve
business processes. The short-term response to the current threat is to
apply the specific patch for SNMP 1. For the long term, IT departments
should systematically upgrade their operating systems.

Over the past several months, eWEEK Labs has advocated simplifying
networks, systems and applications to improve security. In this case,
SNMP commonly uses TCP ports 161 and 162, 191 (both TCP and UDP) along
with three or four others. A good fix is to use a port scan tool to see
if these ports are open. Next determine if the processes supported by
these ports are needed. If yes, leave them open, but monitor their use.
If no, consider turning them off.

This is a great example of a short-term solution. Combined with a quick
check of the equipment vendor's Web site for a patch to the SNMP code,
managers should be able to make the equipment as good as gold.

Now repeat for 3,000 or 4,000 devices.

This is where the long-term management strategy must come into play.
Designing a security audit that goes beyond simply locating equipment
and determining operating system versions is essential for this type of
project in order to reduce IT operational costs.

In the case of the SNMP attack, eWEEK Labs advises that IT managers take
the time to do the project right. Although reports show that the tool,
designed by the Oulu University Secure Programming Group, is likely
circulating underground, many SNMP-equipped devices are obsolete and are
no longer supported by their manufacturers. Thus, a plan that combines
shielding the network from SNMP probes while locating affected devices
and installing updated software images is both urgent and massive.
Putting plans in place to track and update software versions on these
devices—not just fixing the current problem—is an essential step for IT
to proactively strengthen network security.

------------------------ Yahoo! Groups Sponsor ---------------------~-->
Sponsored by VeriSign - The Value of Trust
When building an e-commerce site, you want to start with a
secure foundation. Learn how with VeriSign's FREE Guide.
http://us.click.yahoo.com/oCuuSA/XdiDAA/yigFAA/kgFolB/TM
---------------------------------------------------------------------~->

------------------
http://all.net/ 

Your use of Yahoo! Groups is subject to http://docs.yahoo.com/info/terms/

Next message: Fred Cohen: "[iwar] [fc:Clarke:.Terrorist.Organizations.May.Have.Penetrated.Gov.Computers]"
Previous message: Fred Cohen: "[iwar] [fc:Return.Of.The.'Military-Industrial.Complex'?]"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

This archive was generated by hypermail 2.1.2 : 2002-12-31 02:15:03 PST